The short answer
There is no legal shop, storefront, or marketplace where CVV data can be sold. The phrase "sell cvv on shop" comes from carding forums and search spam, and it describes trafficking in stolen payment credentials. In the United States, that conduct falls under 18 U.S.C. 1029, which covers the sale, transfer, and possession of stolen card numbers and verification codes. Penalties include prison time and fines. Any site that claims to buy or sell CVV data is committing a felony, scamming the person who pays, or running a sting.
What the phrase actually describes
Carding groups use "shop" to mean an automated storefront that lists stolen card records. A listing usually contains a card number, an expiration date, a cardholder name, billing address, and the three or four digit verification code. The code is written as CVV2 on Visa, CVC2 on Mastercard, CID on American Express, and CVV on Discover. The storefront part is just a payment and delivery layer. The inventory is stolen either way.
Why the verification code is the target
Online merchants cannot inspect a physical card, so they rely on the printed verification code to show that someone has the card in hand. A stolen card number alone often fails at checkout because the code is missing. That single fact explains the market: a full record with the code sells for more than a number without one. It also explains why fraud collapses when a merchant requires the code and never stores it.
The legal reality
- Buying, selling, or transferring stolen card credentials is a federal offense under 18 U.S.C. 1029.
- Possession of fifteen or more stolen card numbers can trigger aggravated penalties.
- State laws add their own charges for identity theft and computer fraud.
- Buyers and sellers are both exposed, and forum operators frequently resell buyer payment details.
What legitimate CVV handling looks like
Payment card industry rules prohibit storing the verification code after a transaction is authorized. Requirement 3.2 of the PCI DSS treats the code as sensitive authentication data, alongside full magnetic stripe data and PINs. A compliant merchant sends the code to the processor, receives an authorization response, and discards it. The code never lands in a database, a log file, a customer record, or a support ticket. Tokenization replaces the card number with a reference value so repeat purchases work without keeping the code at all.
Selling CVV on a Shop with Bitcoin: A Comprehensive Guide
Steps to protect your own cards
- Pay with a credit card or a virtual card number rather than a debit card tied to your bank account.
- Check the checkout page for an address bar that shows a secure connection before entering card details.
- Decline to save card data on sites you visit once.
- Turn on transaction alerts in your card issuer's app so you see charges as they post.
- Review statements every month and dispute anything you do not recognize.
Steps if your card data may have been exposed
- Call the number on the back of your card and ask the issuer to freeze the account.
- Request a new card number, not just a new expiration date.
- Change the password on any shopping account that stored the card.
- Place a fraud alert or credit freeze with each of the three credit bureaus.
- Report the incident to the Federal Trade Commission and, if money was taken, to your local police.
Red flags in search results
Pages that promise CVV inventory, use obfuscated spelling, or route buyers through messaging apps are advertisements for crime. Search engines index them, but indexing is not legitimacy. If a page offers card data for sale, close it, and report the listing to the search provider. The only parties who should ever hold a verification code are the cardholder and the payment processor handling that one transaction.